Adding to Jon's comment, the head end device should automatically detect the receiving connection is through a NAT device or not and then use port 4500 for the handshake.

Unless NAT-T is turned off and at that point, just use IPSec over UDP.

Hope this explains.

Cheers

Gilbert

Hi Jon, Gilbert,

I read that there is a security risk in implementing NAT-T. How true is that? Is there something that can be done to reduce the risk?

Like what risk?

Where did you read it?

Give me the article where you read about it.

Thanks

Gilbert

http://www.ietf.org/rfc/rfc3947.txt

See 8. Security Considerations.

Further, I have read Microsoft articles...

support.microsoft.com/kb/885348

While I intend using my VPN Concentrator in the DMZ with my PIX Firewall, I wanted to be sure....

Hi

There are different types of vulnerability

1) Theoretical vulnerabilites ie. in theory it could be done but no one has ever done it.

2) Vulnerabilities where the attacker would need so much access that if they had that access there would be much easier targets to go for.

3) Vulnerabilities which can be exploited without any special access etc.

Together with this you have to balance these vulnerabilities asgainst how likely your company is to be a target.

Reading through your attachment the one i would concentrate on is the use of a group wildcard and pre-shared keys. If you are not already doing it i would strongly recommend you don't use pre-shared keys soley for authentication and use some sort of token based authentication.

HTH

Jon